Struct TwoFactorSetupBroadcast

Namespace

FishMMO.Shared

Assembly

FishMMO.Shared.dll

Broadcast sent by the server after account creation containing encrypted TOTP setup data (otpauth URI and recovery codes) for two-factor authentication.

WARNING: The nonce-derivation scheme on both client and server depends on C# struct field declaration order matching FishNet serialization order. The server sends OtpauthUri first, then RecoveryCodes, and the client consumes them in that exact sequence via receiveNonceCtx.NextNonce(). If these fields are reordered, the nonce streams desynchronize and TOTP silently breaks. DO NOT reorder OtpauthUri and RecoveryCodes.

public struct TwoFactorSetupBroadcast : IBroadcast

Implements

IBroadcast

Inherited Members

ValueType.Equals(object)

ValueType.GetHashCode()

ValueType.ToString()

object.Equals(object, object)

object.GetType()

object.ReferenceEquals(object, object)

Fields

OtpauthUri

Encrypted otpauth:// URI for authenticator app setup (AES-GCM, server->client).

WARNING: FIELD ORDER IS WIRE PROTOCOL -- DO NOT REORDER. The nonce-derivation scheme depends on field declaration order matching FishNet serialization order. See struct remarks.

WARNING: Declaration order IS the wire protocol (see struct remarks). This field MUST remain declared before RecoveryCodes.

public byte[] OtpauthUri

Field Value

byte[]

RecoveryCodes

Encrypted newline-delimited plaintext recovery codes (AES-GCM, server->client).

WARNING: Declaration order IS the wire protocol (see struct remarks). This field MUST remain declared after OtpauthUri.

public byte[] RecoveryCodes

Field Value

byte[]

Seq

Explicit message sequence number (server->client).

NOTE: Seq is declared LAST. The nonce derivation calls NextNonce() for byte-array fields first, then uses Seq for replay tracking. Reordering fields will desynchronize the nonce stream.

The client does NOT use Seq-1 / Seq derivation for these two fields. Instead, it calls receiveNonceCtx.NextNonce() twice sequentially — first for the OtpauthUri, then for the RecoveryCodes. Consequently, the server MUST send the URI before the recovery codes (i.e. the order of the fields in the struct defines the nonce order on the wire). The Seq value itself is only used for replay-window tracking, not for computing per-field nonces.

public uint Seq

Field Value

uint